hardMultiple Choice
SSCP Practice Question: A security analyst reviews firewall logs and sees…
A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?
⚠ Common exam trap
Many exam-takers assume an explicit permit rule guarantees traffic flow, but they forget that ACLs are processed top-down and an earlier deny rule can override a later permit rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An earlier deny rule matches the traffic before the permit rule
The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall rule is disabled
Why it's wrong here
A disabled rule is not evaluated at all, so it would produce no ACL drop log entries; the explicit permit would simply be absent. It is tempting because disabled rules are a common cause of unexpected blocking, and would be correct if the logs showed traffic being permitted that policy intended to deny.
- ✗
The database server is down
Why it's wrong here
An ACL drop is logged by the firewall itself, so the packet never reaches the database server; a downed server would instead produce connection timeouts or TCP resets, not ACL drops. It is tempting because server outages do cause failed connections, and checking service status is a sensible diagnostic step in that scenario.
- ✓
An earlier deny rule matches the traffic before the permit rule
Why this is correct
Firewalls evaluate ACLs top-down and stop at the first match. A deny entry positioned above the explicit permit matches the port 1433 traffic first, so the packet is dropped before the permit is ever evaluated.
- ✗
The internal IP is on a blacklist
Why it's wrong here
A blacklist entry would be evaluated as part of the ACL, so the log would show a deny rule matching, not a drop against an explicit permit. Blacklists are the right mechanism when an administrator wants to block specific known-bad hosts regardless of other rules.
Visual reference
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.